Elastic Container Instance:Grant permissions to a RAM user

Prerequisites

A RAM user is created. For information about how to create a RAM user, see Create a RAM user.

Permission description

You can attach a permission policy to a RAM user to grant specific permissions to the RAM user. The following table describes the policies that are related to Elastic Container Instance resources.

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account.

2. If you want to grant to the RAM user the permissions to manage Elastic Container Instance resources in the Elastic Container Instance console, create a custom policy.

   1. In the left-side navigation pane, choose Permissions > Policies.

   2. On the Policies page, click Create Policy.

   3. Click the JSON tab, copy the following script to the code editor, and then click Next to edit policy information.

      {
          "Statement": [
              {
                  "Action": "ram:ListRoles",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "nas:DescribeFileSystems",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "oss:ListBuckets",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "vpc:DescribeCommonBandwidthPackages",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": [
                      "cr:GetRepoList",
                      "cr:GetRepoTags",
                      "cr:GetImageManifest",
                      "cr:SearchRepo"
                  ],
                  "Effect": "Allow",
                  "Resource": "*"
              }
          ],
          "Version": "1"
      }

   4. Enter a policy name in the Name field and click OK.

3. Grant permissions to the RAM user based on your needs.

   1. In the left-side navigation pane, choose Identities > Users.

   2. Find the RAM user to which you want to grant permissions and click Add Permissions in the Actions column.

   3. In the panel that appears, configure parameters.

      The following table describes the parameters.

      Parameter	Description
      Resource Scope	The authorization scope. Account: The permissions apply to the current Alibaba Cloud account. ResourceGroup: The permissions apply to the specified resource group.
      Principal	The RAM user to which you want to grant permissions. The RAM user that you selected is automatically populated in the Principal field. You can also specify another RAM user.
      Policy	The policies that you want to attach to the RAM user. Select policies that fit your needs. If you want the RAM user only to view Elastic Container Instance resources, select the AliyunECIReadOnlyAccess system policy. If you want the RAM user to manage Elastic Container Instance resources by calling API operations, select the AliyunECIFullAccess system policy. If you want the RAM user to manage Elastic Container Instance resources by using the Elastic Container Instance console, select the AliyunECIFullAccess system policy and the custom policy that you created in Step 2.

   4. Click Grant permissions and follow the on-screen instructions to complete subsequent operations.

References

If you want to control the permissions of RAM users on Elastic Container Instance resources, you can use resource groups and labels to manage the RAM users by group and by permission. For more information, see:

• Use resource groups to control the permissions of a RAM user

• Use labels to authenticate a RAM user